In a enterprise-grade environment, blanket administrative access is an unacceptable risk. Securing data requires granular control over who can alter retention policies, who can initiate a bare-metal recovery, and who possesses the authority to manage cryptographic keys.
StateWarden enforces the Principle of Least Privilege via a strict, multi-tiered Role-Based Access Control (RBAC) architecture operating within your Realm.
1. The Hierarchy of Roles
Access within a StateWarden Realm is divided into specific, immutably defined roles. Each role is designed to fulfill a distinct operational duty without bleeding over into unauthorized domains.
1. Realm Owner (Absolute Authority)
- Scope: The user who created the Realm or to whom ownership was explicitly transferred.
- Capabilities: Full control over all billing, subscription changes, and Realm deletion. Can promote or demote other users to the Admin role.
- Restriction: There can only be one Owner per Realm.
2. Realm Administrator (Operations Command)
- Scope: The primary technical operators of the infrastructure.
- Capabilities: Can invite new team members, provision new Master Keys (in Global Key Mode), delete backups, and globally modify Backup and Security Policies.
- Use Case: Senior DevOps engineers and Lead System Administrators.
3. Operator (Day-to-Day Execution)
- Scope: Users authorized to perform standard recovery and maintenance tasks.
- Capabilities: Can initiate Instant Mounts, trigger manual backups, generate BMR Tokens, and view the Vigil Triage dashboard.
- Restrictions: Cannot delete existing backups, cannot modify global policies, and cannot access the Realm's cryptographic configuration.
- Use Case: Junior administrators, database administrators, and incident responders.
4. Support L1 / Auditor (Read-Only Insight)
- Scope: Personnel requiring visibility into the system's health without the ability to alter its state.
- Capabilities: Can view the Device list, read Audit Logs, view Backup Policies, and read (but not suppress) Vigil findings.
- Restrictions: Strictly Read-Only. Cannot initiate backups, cannot restore data, and cannot modify any configuration.
- Use Case: Compliance officers, external auditors, and Tier 1 support staff.
2. Managing Your Team
Team management is performed entirely within the StateWarden Dashboard.
Inviting a New Member
- Navigate to the Team & Roles section of your Realm Settings.
- Click Invite Member.
- Enter the user's email address and assign their initial Role.
- The system (via our internal
hermesmailer) dispatches a secure, time-limited cryptographic invitation link.
Modifying Access
Access requirements change. Administrators can dynamically elevate or restrict a user's role at any time from the Team dashboard.
- Security Note: If a user's permissions are downgraded (e.g., from Admin to Operator), any active sessions they hold are immediately subjected to the new constraints upon their next API request.
3. The Audit Trail: Unforgeable Accountability
RBAC is only effective if every action is aggressively logged and verified.
Every action taken by any user within the Realm—from a login attempt to the generation of a BMR Token to the suppression of a CVE in Vigil—is permanently recorded in the Realm Audit Log.
- Immutable Tracking: The log records the exact User UUID, the affected Device UUID, the timestamp, and the specific event code (e.g.,
BACKUP_DELETE,KEY_PROVISIONED). - Non-Repudiation: Administrators cannot alter or delete lines from the Audit Log. It serves as cryptographic proof of operations for compliance and post-incident forensic analysis.
StateWarden: Resilience Engineered.